Senior Security Engineer – SIEM & Detection Engineering

Role Overview

Responsibilities

• Architect and maintain SIEM infrastructure for log ingestion, parsing, correlation, and alerting.
• Develop detection content and analytics rules across endpoints, networks, and cloud environments.
• Manage NDR and XDR platforms and integrate telemetry for end-to-end visibility.
• Partner with SOC and Incident Response teams to improve alert fidelity and investigation workflows.
• Integrate SIEM with SOAR and automation pipelines for rapid response and consistent case handling.
• Collaborate on log coverage, retention, and privacy requirements.
• Maintain dashboards, metrics, reporting, documentation, playbooks, and SOPs.
• Perform health checks, tuning, and performance optimization for SIEM and NDR solutions.

Required Qualifications

• 5–8 years of experience in security engineering, detection engineering, or SOC architecture in an enterprise environment.
• Expert-level SIEM knowledge covering onboarding, parsing, rule creation, and optimization.
• Strong detection engineering knowledge, including attack chain mapping, MITRE ATT&CK coverage, and event correlation.
• Experience onboarding logs from firewalls, proxies, endpoints, cloud, identity, and email systems.
• Familiarity with SOAR tools and triage or enrichment automation workflows.
• Strong scripting skills in Python, PowerShell, or Bash.
• Understanding of cloud detection engineering across Azure, AWS, or GCP.
• Excellent analytical, problem-solving, and communication skills.

Technical Skills

• SIEM platforms may include Splunk, XSOAR, Sentinel, or equivalent tools.
• NDR/XDR platforms may include ExtraHop, Vectra, Cisco, CrowdStrike, or similar tools.
• Additional capabilities include data normalization, threat hunting, query development, and identity-based detection.

Preferred Qualifications

• A bachelor’s degree in Cybersecurity, Computer Science, or a related technical field, or equivalent professional experience, is preferred.
• Certifications such as GCDA, GSOC, CompTIA CySA+, ISC2 SSCP, Splunk Enterprise Security certification, or equivalent are preferred.
• Experience designing, scaling, and maintaining enterprise SIEM and detection systems is preferred.

Schedule

• Work hours may vary and may require availability during off-business hours for project needs, system changes, or security events.

Flexible Work

• Mattel describes a flexible work model combining purposeful in-person collaboration with flexibility.